Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH: CVE-2026-81714 (CVSS 7.0) openssl-encrypt <=1.4.8 allows attackers to enroll malicious GPG keys via fingerprint collision, enabling plugin signature bypass. Update to v1.4.9 immediately. #CVE #Vulnerability #PatchNow https://t.co/BEzZ9RCall
Post summary
The tweet announces the high‑severity CVE-2026‑81714, provides technical details of the fingerprint collision flaw, and urges users to patch to v1.4.9.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jahlives | openssl_encrypt | - | python | - |